TrustedVolumes RFQ Swap Proxy — Access Control Exploit (1inch Fusion Resolver)

Timeline: On May 7, 2026, Blockaid detected an ongoing exploit against TrustedVolumes, an independent market-making firm acting as a resolver in the 1inch Fusion network. The attacker exploited a public, unprotected signer-registration function on TrustedVolumes' custom RFQ Swap Proxy contract, enabling them to register as an Allowed Order Signer and forge ~85 signed orders against the resolver's pre-approved liquidity. Initial detection by Blockaid pegged the loss at ~$5.87M; TrustedVolumes later confirmed the total reached ~$6.7M after the drain completed across three receiving wallets. CertiK and SlowMist corroborated the technical analysis. 1inch co-founder Sergej Kunz publicly distanced 1inch protocols from the incident, clarifying that neither 1inch nor its core contracts were compromised. TrustedVolumes published an on-chain message offering a bug bounty dialogue within a 48-hour window. As of May 16, the funds remain static across the three receiving wallets and no recovery has been confirmed.